56bacfb737076b0b10f9896ac124c2e8f83cb855f7b31ef5a95338b7529b3126

Sharing

Copy URL

Twitter E-mail

General

Target

Feather Launcher Setup 1.6.1.exe
Size

104.6MB
Sample

240930-ccrcpasajk
MD5

3a201dabfdaff24a8c208b11049e276d
SHA1

c19478d565e5d3e41347aa65e8cb4b66b31a05f8
SHA256

56bacfb737076b0b10f9896ac124c2e8f83cb855f7b31ef5a95338b7529b3126
SHA512

88a769b8587e8f4ca00546ebd21a976349a2532dde0bca6418f07e56d0a6e2b26c451a379b1ff0b5ffc5448e0d0f5e1c72e7821b3ea5cb0f4e07cf8497112472
SSDEEP

3145728:mkQEzg2K6FiBz+GBTRJmgm0Iiy+FO7Ahhq60XYJMP2ZW:mw26YzlggmtB7Ahh9mxeW

Score

7^/10

discovery persistence

Malware Config

Targets

- Target
  
  Feather Launcher Setup 1.6.1.exe
- Size
  
  104.6MB
- MD5
  
  3a201dabfdaff24a8c208b11049e276d
- SHA1
  
  c19478d565e5d3e41347aa65e8cb4b66b31a05f8
- SHA256
  
  56bacfb737076b0b10f9896ac124c2e8f83cb855f7b31ef5a95338b7529b3126
- SHA512
  
  88a769b8587e8f4ca00546ebd21a976349a2532dde0bca6418f07e56d0a6e2b26c451a379b1ff0b5ffc5448e0d0f5e1c72e7821b3ea5cb0f4e07cf8497112472
- SSDEEP
  
  3145728:mkQEzg2K6FiBz+GBTRJmgm0Iiy+FO7Ahhq60XYJMP2ZW:mw26YzlggmtB7Ahh9mxeW
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/SpiderBanner.dll
- Size
  
  9KB
- MD5
  
  17309e33b596ba3a5693b4d3e85cf8d7
- SHA1
  
  7d361836cf53df42021c7f2b148aec9458818c01
- SHA256
  
  996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- SHA512
  
  1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP
  
  192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/VC_redist.x64.exe
- Size
  
  24.1MB
- MD5
  
  0c86174ca06d892881301203cdf2c32d
- SHA1
  
  2b7462bb7732725f011a085349d6d206eed40048
- SHA256
  
  5d3d8c6779750f92f3726c70e92f0f8bf92d3ae2abd43ba28c6306466de8a144
- SHA512
  
  16c1b043c81394bab65b40c5a9c5b742300cb605d9780226af725bf4d6e38c701f604549b2a3b2138ae951aadfc53faea66c97268c8c61c6c4f0771426ecca62
- SSDEEP
  
  786432:4ipXDWoLTNOqMp5RUlODSV4YloO/Fa2XKS4POTsLK:JpXDhLTNJMpUEYloNS4PvLK
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  
  Feather Launcher.exe
- Size
  
  145.0MB
- MD5
  
  9ef1ecce599882119c5a0715f66dcc55
- SHA1
  
  f6e57a26c0f353ae14302a0a08eed0b4d8946619
- SHA256
  
  4d5066af522559245d0479e7d4ccc69a7f07de88aad84638d06815a6f4ad31e0
- SHA512
  
  f18f2e8b8cdab11305a33fce817715ebaf9d81b1eb4015e19aa1de7b53cc230b78b7b25af6151bdc6ad67c3ce763f294f8b61ecbb254a6ac0a2baea2fc8f0a3c
- SSDEEP
  
  3145728:9FJz+MnHejtWPrMYQWXPQdP57obOO4X7v+N303rVlZ:9FF+MnHejtWPrMYQWXPQdP57obOO4C6p
Score

5^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral13 behavioral14
- Target
  
  LICENSES.chromium.html
- Size
  
  6.3MB
- MD5
  
  997768ae7eb8c036425bed10f766e823
- SHA1
  
  2ec99026b977f6603a8a7890bc05594a9a4f13a1
- SHA256
  
  ab30ee348b3257ec2f19fb5733e64278438be792f1280ce0f28eae0c9cb8943c
- SHA512
  
  f408b817b68861cbad62425e0bb8726f876d36a2212186a8f948d5c825c95ed819dcc41284d8ad8ac11e7ab7ff6141588fededd01c287780f84269846515f639
- SSDEEP
  
  24576:nP9t5W7WSLzrj41T4mfA6c606q6C6eBcHKcaRpG:gFO
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  cb9807f6cf55ad799e920b7e0f97df99
- SHA1
  
  bb76012ded5acd103adad49436612d073d159b29
- SHA256
  
  5653bc7b0e2701561464ef36602ff6171c96bffe96e4c3597359cd7addcba88a
- SHA512
  
  f7c65bae4ede13616330ae46a197ebad106920dce6a31fd5a658da29ed1473234ca9e2b39cc9833ff903fb6b52ff19e39e6397fac02f005823ed366ca7a34f62
- SSDEEP
  
  49152:IuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8cc:oy904wYbZCoOI85oyI
Score

1^/10
behavioral17
- Target
  
  ffmpeg.dll
- Size
  
  2.7MB
- MD5
  
  68ea02ddbfdd0aa3a694789ee6d95bc2
- SHA1
  
  326354fda27d5de1a7bf23b440c6eeb889c7c00d
- SHA256
  
  0c4e27571b2b7c2f50fb6c6d9746fa978079bfb3834bd69ac2f36123c41a0c99
- SHA512
  
  5d517890cfa9782eb5e78ae9bbec54c25b7db1260bc73e39e6b96fc5482b5d7908e25b8b0571eab7129ce78963bea601fecc6be1efda6376addb1c0240e7276e
- SSDEEP
  
  49152:qcDHp0Z63RFIEr1OJbJFk1rb1kjKxt0MWH+4WUA8ZQcyTfQV0U5okJO6V8mK9eoP:DDHeimbJKRkQMdZryTfQV0U5okJzKt
Score

1^/10
behavioral18 behavioral19
- Target
  
  libEGL.dll
- Size
  
  458KB
- MD5
  
  655672c205e37b079c34a4427118479b
- SHA1
  
  e1d595a25e76f2f1be50f0ac3046e82462790d69
- SHA256
  
  498fafb59d3d1a91fa24f95a59411dacf3fb373408e8ea5f931e2ed6b2732d36
- SHA512
  
  a5ad3ac4e382d28d2d95cfc1b02ffca2ba1b5277567c1db81e14a87891e6ef9e5b8b2b56f4b63f8512c0b527dc3de7a5ebf5bb479dad827dfa17294f5874ab92
- SSDEEP
  
  12288:aPwG/ja/jvtG2OQ7Aw1qiQhy/Dq1ug3dk:az/QOQ7Aty/Okkdk
Score

1^/10
behavioral20 behavioral21
- Target
  
  libGLESv2.dll
- Size
  
  7.1MB
- MD5
  
  eb2b911d33f5ba82109a0d5608c28334
- SHA1
  
  fbc578fbcfc88a132438b38e97bb87c16a9f698f
- SHA256
  
  2404be88c798b43499ab7466e2b04bd58510f0d3fa59049aba6ffb932b65c977
- SHA512
  
  19becd2003702813898893f7b1fcd1db179a76fbd201fe34471254b75ba5e98af262922adafe5ef0672302cdf4c0b1e2f8910fd2e51ded0f3c4d6c5a43de489e
- SSDEEP
  
  49152:Nk6rcYCLRRdx7IXvR7vjyhUpSOIpgRcbSIXv9RPKSNtc1OAE3tg5qHqwfuXBMwrE:ZYjEXvRhpS7X7T90VSJAxtLNSg1Sd
Score

1^/10
behavioral22 behavioral23
- Target
  
  resources/app.asar.unpacked/native/cleanup.feather
- Size
  
  989KB
- MD5
  
  7c2dc9165c530f4888ac63233c040560
- SHA1
  
  41f5048d8365df3fd35c744ceb49bb5ff0e63edb
- SHA256
  
  4fcdb7229bfcaa4b158d0a2b4092e76d8145a1e82fa432c99a7d5ad11eb84e9e
- SHA512
  
  a6dcc746353c736d848ae3eed110a519e3db52195f4f02193d322220948073964e53e4d082cf3a07765c48018f357153257cd04d5f5f3d05bb44dfd400b2932b
- SSDEEP
  
  12288:R0dD9oALKpJk9ptMn+lYv58SwpJXkvprbCBTmPxVZIVKayDSYd/:R4xJiJkicM8Swp9yrbCBTmP+zOrd/
Score

1^/10
behavioral24 behavioral25
- Target
  
  resources/elevate.exe
- Size
  
  125KB
- MD5
  
  1d3e78a104f30be7b3f7aa71ffa7900b
- SHA1
  
  53463a970842e544c0784abb748d4ac6c17e511f
- SHA256
  
  158f83e3dce35ad8943c73d3414fe02a4a9ad73527ec4dbd73c15a94accd2345
- SHA512
  
  a35df4ea88a8e44931dcf939958e6004d3024c9d8afa892dcfb8755546505f33fa70b7c04a3d85627ffdef66c08f2fe341a1756a63323fdf6fea17f71f85bdbf
- SSDEEP
  
  3072:UVbLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWlYDTDu:kPrwRhte1XsE1lYPi
Score

3^/10

discovery
behavioral26 behavioral27
- Target
  
  vk_swiftshader.dll
- Size
  
  4.6MB
- MD5
  
  17bb7a2a7cd8ccd96ed19753cfc75bec
- SHA1
  
  7c996eaa179fd472a572a0efb3e243a81b283977
- SHA256
  
  070c9bb970f13a47e3246fbeadd4d2d3916273e1ae3db2059d806691bfeaf6d8
- SHA512
  
  80ff7ba1b32e3de374e8637852b96c12882a5f7d32651ff0e1c2cb97898a44aee46a569a42b073a4e368f364f0daae2e86eca36068fe6794eb5ba55cd3ca5ee4
- SSDEEP
  
  49152:eg0lNhuGaO/dRxQGQ+mEjWIyKGTJtE+M5q0yN769reA3Em0PNX4WbUEwxWvbG5wW:jm/j7sw7kQtlVdQQog
Score

1^/10
behavioral28 behavioral29
- Target
  
  vulkan-1.dll
- Size
  
  849KB
- MD5
  
  58871cf606db440509b56a3f764e72e3
- SHA1
  
  312e810cfcfb663b0da00eac3b87294c0b035cfa
- SHA256
  
  ea1f3a66f9322d20da4542c42595eb789e532a224a0338dc488e998ae00e59ea
- SHA512
  
  07279c40721414f6ab345f83d9189c3c7012a54fc839359cb33cf4793ea771507535518554be99bac339463b7bee89e263e7a5cdd3f443a550ca6476c350a2a4
- SSDEEP
  
  12288:EaVRm5GYB4ad1TQxKhZasTkTDimWLr4Tg+v+U8Amor8F:Eaa5GqLd1T6aDk6LrSL2l
Score

1^/10
behavioral30 behavioral31
- Target
  
  $PLUGINSDIR/nsExec.dll
- Size
  
  6KB
- MD5
  
  ec0504e6b8a11d5aad43b296beeb84b2
- SHA1
  
  91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA256
  
  5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- SHA512
  
  3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP
  
  96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Adds Run key to start application

Enumerates connected drives

Checks computer location settings

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Checks computer location settings

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32